When the ap has joined a wlc, the dns and dhcp option 43 is not used. The information created in the mobility group (mac address, ip address and mobility group name) is used. This is how ap's learn of the other wlc. Setting the ap's primary and secondary and or tertiary wlc is required for ap's to be able to join the other wlc. Option 43 and dns is used if the ap goes throught the proccess of finding a wlc if the primary, secondary and or tertiary wlc is not found. It seems to me that the ap's have properly joined a wlc, there for, you need to verify why the 1121'a are not joining the secondary.
First of all, is the mobility group configured correctly and is ap fallback enabled or not. Also, verify that you can mping and eping the controllers. Is the wlc set to layer 2 or layer 3 mode? I think that the 1121 needs the wlc to be in layer 3, but I will check.
What you should also do is console into the ap and post the log so we can see what errors the ap is getting.
From my experience, all the new APs, 1131s, and 1200s series use MICs (Manufacturer Installed Certificates). So depending on when the AP was manufactured, it may have a MIC or generates an SSC when you convert it. All LWAPP APs have MICs. When I converted 1300+ AP1200s, only about 100 of them had MICs.
1010 access points are the original Aironet access points and should come with a MIC since they are controller-only. So you have the right idea, but 1000-series access points will be an exception to the rule.